Comodo KoruMail Software Version 4.0

Transcription

1 St rat Comodo KoruMail Software Version 4.0 Admin Guide Guide Version Comodo Security Solutions 1255 Broad Street Clifton, NJ 07013

2 Table of Contents 1 Introduction to KoruMail Messaging Gateway Product Packet Product Box Overview Installing the Appliance Prerequisite Deployment in Data Centers Accessing the Appliance Accessing via CLI Console Accessing via Web Console The Main Interface The Dashboard System Usage Graphics About Software Changing your Password User Management Managing Administrative and End Users Managing Administrative Users Managing End Users Managing Groups System Configurations Network Configuration Interfaces Network Settings Network Time Protocol (NTP) Timezone Static Routes Simple Network Management Protocol (SNMP) Services License Configuring System Settings System General Settings Cache Settings Session Settings GUI Customization System Backup System Restore Log Upload Settings Postmaster Settings SMTP TLS Settings Update Database Syslog Server Logs Log Files

3 7.5.2 Purge Files Tools Check Connectivity Clear SMTP Queue System Usage Statistics SMTP Configuration SMTP (Send Protocol) Settings General Settings Advanced Settings Outbound Delivery Queue Manage Domains Managing Domain Names Managing Domain Routes Managing Smart Hosts Default Domain Routing KoruMail SMTP AUTH Connector SMTP Authentication Settings Block Users Anomaly Detection LDAP/Local DB/My SQL User Database LDAP Profile Local DB Users My SQL User Database Greylist Greylist Ignored IP Addresses/Domains Managing RBL Servers Disclaimer SMPT Relay DomainKeys Identified Mail (DKIM) Outgoing SMTP Limits Modules Anti-spam Anti-spam General Settings Authorized Trainers Advanced Anti-spam Settings Bayesian Training Content Filter Signature Whitelist Anti-Virus Anti-Virus General Settings Advanced Anti-Virus Settings KoruMail Reputation Network (KRN) Anti-Spoofing SMTP IPS/FW SMTP IPS General Settings Whitelist IP Addresses

4 9.5.3 Blocked IP Addresses Rate Control Data Leak Prevention (DLP) Anti-Phishing Anti-phising General Settings Promotional Profile Management Adding and Configuring a New Profile Editing a Profile Deleting a Profile Reports Mail Logs Report SMTP Queue Report Delivery Logs Report SMTP-AUTH Logs Report Summary Reports Domain Reports Quarantine & Archive Quarantine & Archive Settings Quarantine & Archive General Settings Reports Settings Quarantine Logs Archived Mails About Comodo

5 1 Introduction to KoruMail Messaging Gateway With unsolicited s increasing with each passing day, employee mail boxes are flooded with spam messages that contain viruses, phishing links and more. Productivity can decline as individuals waste valuable time sorting genuine mails from junk. If a user opens a malicious attachment or visits a fraudulent website then organizations may find their network compromised or infected. Comodo's KoruMail Messaging Gateway is an antispam and threat prevention appliance that users advanced filtering technologies, antivirus scanners and content analysis engines to quietly and effectively prevent unsolicited mail from entering your network. Key Features LDAP control RBL (Realtime Blocking Lists) MX Reverse DNS White / gray / black lists, add titles which are industrially proven filtering techniques SRN Reputation Network Active Directory Integration Quarantine Reporting, Quarantine Webmail Reporting Guide Structure This guide is intended to take the user through the installation, configuration and use of Comodo KoruMail. Introduction to KoruMail Messaging Gateway Product Packet Installing the Appliance Accessing the Appliance Accessing via CLI Console Accessing via Web Console The Main Interface The Dashboard System Usage Graphics About Software Changing your Password User Management Managing Administrative and End Users Managing Groups System Configurations Network Configuration Services License Configuring System Settings Logs Tools 5

6 2 2.1 System Usage Statistics SMTP Configuration SMTP (Send Protocol) Settings Manage Domains Surgate SMTP AUTH Connector LDAP/Local DB/My SQL User Database Greylist Managing RBL Servers Disclaimer SMPT Relay DomainKeys Identified Mail (DKIM) Outgoing SMTP Limits Modules Anti-spam Anti-Virus KoruMail Reputation Network (KRN) Anti-Spoofing SMTP IPS/FW Data Leak Prevention (DLP) Anti-Phishing Promotional Profile Management Adding and Configuring a New Profile Editing a Profile Deleting a Profile Reports Mail Logs Report SMTP Queue Report Delivery Logs Report SMTP-AUTH Logs Report Summary Reports Domain Reports Quarantine & Archive Quarantine & Archive Settings Quarantine Logs Archived Mails Product Packet Product Box After unpacking the box, please make sure the following components are available: 6

7 1. Power cable (1) 2. Installation Instructions 3. Platform (1U or 2U model) 4. Rail-kits 5. Admin Guide (this document) 2.2 Overview KoruMail Messaging Gateway s C series (C3000) and E series (E5100) front views shown below Installing the Appliance Prerequisite Before installing the KoruMail appliance, the following conditions must be complied with: 1. Source IP of incoming mail traffic should not be changed by other devices. If the incoming s are routed via a load balancer to KoruMail then make sure the balancer s settings is configured not to change the source IP. Else IP based filtering will not work properly. 2. An A and MX records should be entered for korumail.domain.com 3. For the protected domains, only one MX, Reverse DNS record should exist and it must point to KoruMail. Otherwise spams and viruses passes from other servers in MX records without being filtered via KoruMail. Also, if possible SMTP port 25 should not be accessible from outside for the s to be protected by KoruMail. Spammers can keep MX records in their memories before KoruMail installation and they can send spam/virus directly to actual mail server bypassing KoruMail. 4. Firewall should be permitted as follows: Traffic to KoruMail: 1. Port 8080 and port 8443 (GUI interface and quarantine reports) must be open from outside to KoruMail 2. Port 25 must be open from outside to KoruMail 3. Port 22 should be open for KoruMail Support Center (78,186,198,152) to remote access Traffic from KoruMail: 7

8 All connections to the outside must be accessible Deployment in Data Centers Note the following points before starting: 1. Switch off the appliance then unplug the AC power cable 2. Remove all the cables and communication tools plugged into the device 3. Empty static electric on your body You must place the appliance into rack cabinet with the rail-kit. Before starting to use KoruMail appliance, check the following: 1. Power and network cables have been plugged in 2. Device's network settings have been done properly as explained in the section Accessing via CLI Console After completing the above steps you can do all other configurations in detail explained in the section System Configuration. 4 Accessing the Appliance KoruMail s default IP address is and you can use this to access the appliance for initial configuration. Default username is admin. For password please contact Comodo sales representative. There are two ways to access the appliance: 1. Text menu-based CLI (Command Line Interface) console 2. Graphic-based web management console 4.1 Accessing via CLI Console If is not accessible from your network then the easiest way to access the console is by attaching a monitor to the appliance. Basic operations can be done here. Then rest of the network settings on the appliance can be done remotely in detail via a web browser. CLI username described as 'shell' and password as 'surgateshell'. For the first time you will be asked to change the password. After logging-in in with your new password, the following menu will be displayed. 8

9 All the appliance's functions cannot be configured via the CLI and limited important tasks can be performed in the following order: 1. Network configuration 2. Reboot 3. Halt 4. Pinging a host to check whether the network access is exist 5. Restarting the web management console 6. Changing CLI password 7. Changing the password for web management console 8. Displaying the network configuration 9. Displaying the network interface As an example, the following screenshot shows how to make network configuration. 9

10 Accessing via Web Console 3. Enter KoruMail Messaging Gateway s IP or host name together with port 8080 (Example: in the address bar of a browser Enter your username and password. Default user name is admin. For password please contact Comodo's sales representative Choose one of the language options (English/Turkish) 4. Click the login button To connect via secure HTTPS connection, click the SSL' icon and enter the credentials In case you have forgotten the password, click the 'Forgot Password' link, enter your address and click the 'Send' button to receive a new password. Users can view their quarantined mails by clicking the 'Quarantine Webmail' link and providing their credentials in the KoruMail Quarantine Webmail interface. Refer to the section 'Managing End Users' for more details. 2. Note: The credentials are case sensitive, and so should be entered as configured. If there is no activity by the admin for a specified time (30 minutes by default) in KoruMail s control window then the session will time out. You should login again to access the KoruMail s control panel. 4.3 The Main Interface The user-friendly graphical user interface of the administrative console provides easy access to the information and configuration screens of all the modules in the KoruMail Messaging Gateway, with configuration tabs on the left side and the 10

11 respective settings screen on the right side. Configuration Tabs The tabs on the left pane allows administrators to add new users, groups, configure various settings such as domains, SMTP, view and generate reports and more. User Management: Allows to add/edit groups and admin users with different privileges. Refer to the section 'User Management' for more details. System: Allows administrators to configure network settings, add NTP servers, enable or disable services such as anti-spam engine, Snmpd, KoruMail delivery agent, view and update license and more. Refer to the section 'System Configuration' for more details. SMTP: Allows administrators to configure SMTP settings, add domains, add new LDAP profile, create greylist of domians, IP or network address, set outgoing limits and more. Refer to the section 'SMTP Configuration' for more details. Modules: Enable or disable anti-spam, anti-virus, anti-spoofing, anti-phishing and configure settings for anti-spam training and content filter. Refer to the section Modules for more details. Profile Management: Configure various settings such as anti-virus, anti-spam, blacklist and more for default incoming and outgoing profile. Refer to the section 'Profile Management' for more details. Reports: View and generate log reports for incoming and outgoing mails and a summary of mails categorized as spam, RBL, phishing and more. Refer to the section 'Reports' for more details. Quarantine & Archive: Enables to configure Quarantine and Archive settings, view quarantined mail logs and archived mails. Refer to the section 'Quarantine & Archive' for more details. Dashboard After logging-in to the console, the first screen displayed is the 'Dashboard'. It provides at-a-glance view of system usage such as SMTP, Queue mails, network utilization rate, CPU and memory utilization. System Messages: Displays error messages or important notifications that might affect the performance of the messaging gateway. System Usage Graphics: Provides a graphical representation of the system usage such as SMTP connection rate in hourly, daily, weekly, monthly or yearly basis, utilization of network, CPU, disk and memory. Refer to the section 'System Usage Graphic' for more details. About: The 'About' area in the dashboard allows administrators to change the current password, view details of the appliance and software and manage the license. Refer to the section 'About Software' and 'Changing your Password' for more details. 11

12 5 The Dashboard The Comodo KoruMail Dashboard provides at-a-glance statistical summary of the current running status, system messages and allows administrators to change the password and update license. The Dashboard is displayed by default whenever you login to the administrative interface. To switch to 'Dashboard' from a different configuration screen, click on the 'KoruMail Messaging Gateway' logo at the top left. The 'System Messages' displays error messages or important notifications that might affect the performance of the messaging gateway. Click the following links for more details about other areas in the dashboard: System Usage Graphics About Software Changing your Password 5.1 System Usage Graphics The 'System Usage Graphics' area in the 'Dashboard' displays the graphical summary of SMTP connections, number of queued mails, network utilization rate, CPU utilization rate, disk usage ratio and system memory utilization rate. By default, it displays the hourly statistics and tabs in the second row allow to view the graphical summary for daily, weekly monthly and yearly basis. 12

13 SMTP: Displays the maximum, average and current SMTP connections to KoruMail for the selected period. Queue: Displays the maximum, average and current s in queue for the selected period. Network: Displays the network utilization rate of the system for the selected period. CPU: The maximum, average and current CPU utilization rate for the selected period. Disk: Displays the system's disk usage ratio for the selected period. Memory: Displays the system's memory utilization rate for the selected period. Refer to the System Usage Statistics section for more details about each of the item. 5.2 About Software The 'About' section in the 'Dashboard' area in addition to displaying the system's hardware and software details also allows to change the web console access password. 13

14 The screen displays the details about KoruMail such as engine version, user interface version and more. Clicking the 'Details' link at the bottom opens another 'About' screen that provides more details. By default, the screen under 'About KoruMail' will be displayed and provides additional contact information. Clicking the 'Open License Manager' link at the bottom opens the 'License' interface, which allows to view current license details and update licenses. Refer to the section 'License' for more details. Click the 'System Admin' tab to view and/or update the system. 14

15 In System Admin screen, name, last name, phone number and address of the system administrator are entered. When SMTP IPS module blocks the IPs, the details of blocked IP addresses are sent to this address. Click 'Save' after the details are provided in the fields. If the field 'System Admin ' is left blank, then a error message will be displayed under the 'System Messages' in the 'Dashboard'. 5.3 Changing your Password You can change your current password anytime from the 'About' section. To change your password, from the 'Dashboard' screen click the 'Change Password' link in the 'Username' row. In the 'Change Password' screen, enter the current password and then enter the new password and confirm it in the last field. Click the 'Save' button. The password details will be updated and you have to use the new password to access the KoruMail's web console. 6 User Management The 'User Management' area allow administrators to create new admins and configure their privileges. The 'Quarantine Webmail User' tab allows administrators to add recipients' details so that they can log into the console to view their quarantined s. The interface also allows the creation of user 'Groups' with different access levels. 15

16 Click the following links for more details: Managing Administrative and End Users Managing Groups 6.1 Managing Administrative and End Users The KoruMail's web console can be accessed by administrators and used according to their privileges. The 'User Management' area also allows administrators to add end users so that the recipients can access the web console and view their quarantined s. A new administrator added to the list has to be compulsorily assigned a 'Group'. So make sure an appropriate group already exists for the administrator or create a new group. Refer to the section 'Managing Groups' for more details. To open the 'Users' screen, click the 'User Management' tab on the left side and click 'Users'. Click the following links for more details: Managing Administrative Users Managing End Users 16

17 6.1.1 Managing Administrative Users To open the 'Administrative Users' screen, click the 'User Management' tab on the left side and click the 'Administrative Users' tab from the 'Users' screen. Administrative Users Table of Column Descriptions Column Header Description Username The username provided at the time of adding the administrator to access the web console. Group Displays the name of the group to which the administrator belongs. Refer to the section 'Managing Groups' for more details. Administrators with appropriate privileges can delete other admins by clicking this icon. Please note logged-in admin cannot be deleted by himself/herself. Action Stratus Administrators with appropriate privileges can edit other admins' details. Refer to the section 'Editing an Administrator' for more details. Indicates whether the admin is in enabled or disabled status. Disabled admins cannot log into the web console. Refer to the section 'Enabling/Disabling Administrators' for more details. From the this interface an appropriately privileged administrator can: Add an administrative user Delete an administrative user Edit an administrative user Enable/Disable an administrative user To add an administrative user Click the 'Add User' link 17

18 The 'Add New User' screen will be displayed. Username: Enter the username to access the console Authentication Type: Two options are available Local DB and LDAP AD Local DB Authentication of the user will be done using the local database LDAP AD Authentication of the user will be done using LDAP Password: Enter the password to access the console and confirm it in the next field. Name: The first name of the administrative user Surname: The surname of the user Enter the address of the administrative user Group: Select the group to which the admin user should be added. Refer to the section 'Managing Groups' for more details. Click the 'Save' button to add the new admin user. To delete an administrative user Click the icon beside the user that you want to delete 18

19 Click 'OK' to confirm the deletion. To edit an administrative user Click the icon beside the user that you want to edit The 'Edit User' screen will be displayed: Edit the details as required. The screen is similar to the 'Add New User' section. Refer to 'Add an administrative user' for more details. Click the 'Save' button. The changes will be saved and a confirmation note will be displayed. To enable/disable an administrative user The icon under the 'Status' column indicates whether the 'Administrator User' is enabled or disabled. Indicates the user is disabled and cannot login to the web console Indicates the user is enabled and can access the web console Click the icon to toggle between enabled and disabled statuses. Click 'OK' in the confirmation dialog Managing End Users In order to allow end users ( recipients) to view their quarantined s, administrators can provide them access to the 19

20 web console. They can view only their quarantined mails. The 'Quarantine Webmail Users' tab in the 'Users' interface allow administrators to add end users, edit or delete them. To open the 'Quarantine Webmail Users' screen, click the 'User Management' tab on the left side, click 'Users' and then click the 'Quarantine Webmail Users' tab from the 'Users' screen. Quarantine Webmail Users Table of Column Descriptions Column Header Username Description The username provided at the time of adding the end user to access the web console. Administrators with appropriate privileges can delete the end user by clicking this icon. Action Administrators with appropriate privileges can edit end user's details. Refer to the section 'Editing an End User' for more details. Status Indicates whether the end user is in enabled or disabled status. Disabled end users cannot log into the web console. Refer to the section 'Enabling/Disabling End Users' for more details. From the this interface an appropriately privileged administrator can: Add an end user Delete an end user Edit an end user Enable/Disable an end user To add an end user Click the 'Add User' link 20

21 The 'Add New User' screen will be displayed. E mail: The address of the end user Name: The first name of the end user Surname: The surname of the end user Password: Enter the password to access the web console and confirm it in the next field. Click the 'Save' button to add the new end user. To delete an end user Click the icon beside the user that you want to delete Click 'OK' to confirm the deletion. To edit an end user Click the icon beside the user that you want to edit The 'Edit User' screen will be displayed: 21

22 Edit the details as required. The screen is similar to the 'Add New User' section. Refer to 'Add an end user' for more details. Click the 'Save' button. The changes will be saved and a confirmation note will be displayed. To enable/disable an end user The icon under the 'Status' column indicates whether the 'Administrator User' is enabled or disabled. Indicates the user is disabled and cannot login to the web console Indicates the user is enabled and can access the web console Click the icon to toggle between enabled and disabled statuses. Click 'OK' in the confirmation dialog. 6.2 Managing Groups The 'Groups' interface allows the administrators with appropriate privileges to create administrator groups according to the needs of the organization. Each group can be configured with different permission levels. This simplifies the process of configuring permission levels for each administrator meaning new or existing administrators belonging to the account can be simply assigned a group with a preset policy. The admin interface will vary according to his/her permission level. Refer to the section 'Managing Administrative Users' for more details on how to assign a group to admin users. To open the 'Groups' screen, click the 'User Management' tab on the left side and click 'Groups' 22

23 Groups Table of Column Descriptions Column Header Description Group Name The name of the group Group Description Enter an appropriate description for the group Administrators with appropriate privileges can delete the group by clicking this icon. Action Administrators with appropriate privileges can edit group details and its privileges. Refer to the section 'Edit a Group' for more details. From the this interface an appropriately privileged administrator can: Add a new group Delete a group Edit a group To add a new group Click the 'Add group' link The 'Add New Group' screen will be displayed. Group Name: Enter the name of the group Group Description: Enter an appropriate description for the group Group Privileges: Select the privileges that should be assigned to the group from the 'Privilege Name' drop-down. 23

24 After the selecting the privilege for the group, click the 'Add' button displayed. to include it. The added privileges will be By default, the added privileges will have 'Read' rights only, meaning the features can be viewed and cannot be configured by the admin user. Select the 'Write' option to make the privileges configurable for the admin user. To select the 'Write' or 'Read' option for all the privileges, click the 'All' link below it. To delete a privilege, click the delete icon beside it. Click the 'Save' button to add the new group. Now this new group can be assigned to admin users. Refer to the section 'Managing Administrative Users' for more details on how to assign a group to admin users 24

25 To delete a group Click the icon beside the group that you want to delete Click 'OK' to confirm the deletion. To edit a group Click the icon beside the group that you want to edit The 'Edit group' screen will be displayed. Edit the details as required. The screen is similar to the 'Add New Group' section. Refer to 'Add a new group' for more details. Click the 'Save' button. The changes will be saved. 7 System Configurations The 'System' tab on the left side of the web console allows administrators to configure important parameters of the KoruMail after the initial configuration as explained in the section 'Installing the Appliance'. 25

26 Network: Allows admin users to configure various network settings of KoruMail such as default gateways, DNS servers, NTP servers and more. Refer to the section 'Network Configuration' for more details. Services: Allows admins to start or stop various services such as Delivery Agent, SMTP, Snmpd, Scheduler and more. Refer to the section 'Services' for more details. License: View and update KoruMail licenses from this interface. Refer to the section 'License' for more details. Settings: Configure various system settings such as Cache, Session, Backup and more. Refer to the section 'Configuring System Settings' for more details. Logs: View and download mail log files and configure how long the system should retain mail log records, archived mails and quarantined mails. Refer to the section 'Logs' for more details. Tools: Allows admin users to check connectivity such as SMTP, Ping, Nslookup, Telnet as well as clear SMTP queue. Refer to the section 'Tools' for more details. Statistics: View the graphical summary of system usage. Refer to the section 'System Usage Statistics' for more details. 7.1 Network Configuration The 'Network' tab allows administrators to configure various settings for the system such the IP addresses for the Network Interface Card (NIC), define a hostname, default gateway addresses, primary and secondary DNS server details, Network Time Protocol (NTP), static route and Simple Network Management Protocol (SNMP) servers. To open the interface, click the 'System' tab and then the 'Network' sub tab. 26

27 Click the following links for more details of each of the settings: Interfaces Network Settings Network Time Protocol (NTP) Time Zone Static Routes Simple Network Management Protocol (SNMP) Interfaces The initial configuration of KoruMail is done at the time of installation using the Command Line Interface (CLI) console and can be edited and updated using the web console. Refer to the section 'Installing the Appliance' for more details. The details of the Network Interface Card (NIC) can be edited/updated from the 'Interfaces' screen. To open the 'Interfaces' screen, click the 'System' tab on the left side, then 'Network' and 'Interfaces' from the 'Network' screen. Interfaces Table of Column Descriptions Column Header Interface Name Description The name of the Network Interface Card (NIC) with physical Ethernet ports. The number of ports available depends on the appliance model. If two ports are available, then the appliance can be configured to route inbound and outbound s on separate Ethernet ports. This configuration is preferable because it provides the best network bandwidth. If a single Ethernet post is available then 27

28 both incoming and outgoing s are routed via the same port. This may result in network bottlenecks, but can be used for organizations with relatively low traffic. IPv4 The IPv4 address assigned to the port IPv4 Netmask The IPv4 netmask address assigned to the port IPv6 The IPv6 address assigned to the port IPv6 Prefixlen The prefix of the IPv6 address Status Indicates whether the interface is enable or disabled. The link toggles between 'Active' and 'Inactive' statuses. Click on the link to make the interface 'Active' or 'Inactive'. Allows to edit the settings of the NIC. Refer to the section 'To edit the interface' for more details. Edit From this screen, administrators can edit the interface settings. To edit the interface Click the icon beside the interface that you want to edit The 'Edit interface' screen will be displayed. Interface Name: The name of the network interface card. This name is not editable. IPv4: The IPv4 address of the port. Edit as required. IPv4 Netmask: The IPv4 netmask address of the port. Edit as required. IPv6: The IPv6 address of the port. To disable the IPv6 settings, select the 'Remove IPv6 settings' check box. IPv6 Prefixlen: Enter the prefix length for the IPv6 address Hostname: The hostname of the system. The changes will be reflected in the 'Network Settings' interface also. IPv4 Default Gateway: The IPv4 default gateway that KoruMail will be using to connect to other networks or the Internet. Edit as required. The changes will be reflected in the 'Network Settings' interface also. IPv6 Default Gateway: The IPv6 default gateway that KoruMail will be using to connect to other networks or the 28

29 Internet. Edit as required. The changes will be reflected in the 'Network Settings' interface also. Primary DNS Server: The IP of the primary DNS server that KoruMail is configured. Edit as required. The changes will be reflected in the 'Network Settings' interface also. Secondary DNS Server: The IP of the secondary DNS server that the appliance is configured. Edit as required. The changes will be reflected in the 'Network Settings' interface also. Continent: The name of the continent where the system is located. City: The name of the city where the system is located. Current timezone: The timezone of the city. Click the 'Save' button. A reboot confirmation screen will be displayed. Reboot will not be required for DNS setting changes. Click 'Yes' to confirm the changes and reboot the system Network Settings The 'Network Settings' interface allow administrators to change the hostname of KoruMail, IPv4 and IPv6 default gateways, primary and secondary DNS server settings. The changes done here will also be reflected in the 'Edit Interface' of the NIC as explained in the previous section 'Interfaces'. To open the 'Network Settings' screen, click the 'System' tab on the left side, then 'Network' and 'Network Settings' from the 'Network' screen. Hostname: The hostname of KoruMail. The changes will be reflected in the 'Edit interface' of the NIC also. IPv4 Default Gateway: The IPv4 default gateway that KoruMail will be using to connect to other networks or the Internet. Edit as required. The changes will be reflected in the 'Edit interface' of the NIC also. IPv6 Default Gateway: The IPv6 default gateway that KoruMail will be using to connect to other networks or the Internet. Edit as required. The changes will be reflected in the 'Edit interface' of the NIC also. To disable the IPv6 settings, select the 'Remove IPv6 settings' check box. Primary DNS Server: The IP of the primary DNS server that the system is configured. Edit as required. The changes will be reflected in the 'Edit interface' of the NIC also. 29

30 Secondary DNS Server: The IP of the secondary DNS server that the system is configured. Edit as required. The changes will be reflected in the 'Edit interface' of the NIC also. Click the 'Save' button. A reboot confirmation screen will be displayed. Reboot will not be required for DNS setting changes. Click 'Yes' to confirm the changes and reboot the system Network Time Protocol (NTP) Network Time Protocol (NTP) is an Internet protocol that is used to synchronize computer clocks over a network. The 'NTP Servers' screen allow administrators to add time synch servers for KoruMail. To open the 'NTP Servers' screen, click the 'System' tab on the left side,then 'Network' and 'NTP' from the 'Network' screen. To add a new NTP server Enter the name or IP address of the server in the 'Server name' field and click the 'Add' button. The 'Settings saved successfully' will be displayed. To remove a NTP server Click the 'Delete' button beside the server name in the list. In the confirmation dialog, click 'OK' to remove the NTP server from the list Timezone The 'Timezone' tab in the web console allow administrators to configure the time zone of the system to which you want to 30

31 synchronize the time. To open the 'Timezone' screen, click the 'System' tab on the left side,then 'Network' and 'Timezone' from the 'Network' screen. Continent: Select the continent from the drop-down City: Select the city from the drop-down Click the 'Save' button. A reboot confirmation screen will be displayed. Click 'Yes' to confirm the changes and reboot the system. The changes done here will also be reflected in the 'Edit Interface' of the NIC as explained in the previous section 'Interfaces' Static Routes KoruMail can be configured to redirect traffic to different servers using the static route in addition to the default gateway configured in 'Network Settings' section. To open the 'Static Routers' screen, click the 'System' tab on the left side, then 'Network' and 'Static Routes' from the 'Network' screen. 31

32 From this screen an administrator can: Add host names or IP address Delete host names or IP address View the network route To add host names or IP address Enter the host name or IP address of the machine that you want to specify a static route in the 'Host Name or IP Address' field. Enter the IP address of the gateway that the machine should connect to. Click the button under the 'Action' column. The system will be added and displayed below the field. Repeat the process to add more machines. Alternatively, you can also import the machines from a file. To import the machines, click the 'Import' link 32

33 The 'Import' dialog will be displayed. Click the 'Upload' button, navigate to the the location where the file is saved, select it and click 'Open'. The file will be added. Repeat the process to add more files. To remove a file, click the 'Clear' link beside it. To remove all the added files, click the 'Clear All' button at the top right. To import the machines from the files, click the 'Save' button. 33

34 To save the details of machines and gateway, click the 'Export' link and save it to your system. To delete host names or IP address Click the beside a system to remove it from the static route and click 'OK' in the confirmation dialog. To remove all the machines from the list, click the 'Delete all' link at the bottom and click 'OK' in the confirmation dialog. To view the network route Click the 'Show Route' to view the 'Routing tables' for the machines. 34

35 7.1.6 Simple Network Management Protocol (SNMP) Simple Network Management Protocol (SNMP) allows administrators to monitor network devices such as KoruMail. Before configuring the SNMP settings, download the SNMP agent and Management Information Base (MIB). To configure SNMP settings, click the 'System' tab on the left side,then 'Network' and 'SNMP' from the 'Network' screen. System Location: Name of the location where the KoruMail device is located. System Contact: The name, telephone number and/or address of the system administrator to contact. Click the 'Save' button. IP: Enter the IP address of the SNMP Manager system Community: The community string that is defined between SNMP manger and the SNMP agent in KoruMail. It acts like a password to provide access to the agent in KoruMail. Click the link to add the SNMP manager. You can add multiple SNMP managers. You can delete any currently SNMP access enabled hosts by clicking the 7.2 link click 'OK' in the confirmation dialog. Services The 'Services' screen provides the current statuses of various KoruMail services. You can stop or restart a service and also shutdown or reboot KoruMail. To view and configure KoruMail services, click the 'System' tab on the left side,then 'Services' 35

36 The icons in the 'Legend' screen provides the status details of the services. Description of the Services Column Header Description KoruMail Delivery Agent The service forwards the s processed by KoruMail to target server. KoruMail SMTP Service The service that filters s on hosted domain names on KoruMail. This service accepts incoming connections listening to port 25 of SMTP. The SMTP service filters the s per the settings configured by the administrator (Reverse DNS, RBL, SRN, MX control the White List, Black List, Grey List, etc.) in SMTP level first and then the filtered s are passed to the next stage - KoruMail Main Engine for spam and virus analysis. Submission SMTP Service Submission port (587), is a mail delivery port as port 25 (SMTP) but it requires additional authentication. If you do not have an account on this server, you cannot send an . KoruMail Main Filtering Engine The s that are filtered by 'SMTP Service' are passed to the main filtering engine software that checks for spam and virus in the mails. This module performs the actions specified by administrator such as rejecting, quarantining the infected or saving the to another register area or address. If is required to be sent to recipient then it is forwarded by the KoruMail Delivery Agent. Anti-spam Engines KoruMail antispam engines scans s and specifies spam scores controlling thousands of spam signatures such as header and bayesian-based content filtering. This scores are used to define an as spam. KoruMail DB Connector The Postgre SQL services running on KoruMail's internal database of quarantined s and archives. Syslogd <to get clarification from Hasan> Snmpd Service It is an Simple Network Management Protocol (SNMP) agent which binds to port and acts on SNMP management application s requests and sends the requested information to the requester. Anti-virus Module KoruMail includes Comodo's anti-viurs programs as a built in solution. 36

37 Scheduler Service This service organizes the programs that runs periodically. This feature in KoruMail Messaging Gateway creates periodic reports and graphics about system usage. To start or stop a service, click on the buttons beside it. Indicates the service is running. Click on the button under the 'Start / Stop' column to stop the service. Indicates the service has stopped. Click on the button under the 'Start / Stop' column to start the service. To restart a service, click on the button under the 'Restart' column. If the service is running, it will stop and restart again. If the service is stopped, then it will restart. To shutdown the KoruMail, click on the To reboot the KoruMail, click on the 7.3 button. button. License The 'License' screen in the web console allows administrators to view the current license details as well as to create a license request and install a new license. The 'License' for KoruMail can be purchased at Comodo Accounts Manger (CAM) page and is priced according to the number of users and license period. To view and purchase new KoruMail license, click the 'System' tab on the left side,then 'License' From here an administrator can: View the details of your current license Purchase a license Activate your license Read End User License Agreement (EULA) To view the details of current license Click the 'Licenses' tab 37

38 License Table of Column Descriptions Column Header Description CAM User Address The ID provided at the time of CAM sign-up. CAM Automatic Renewal Indicates whether automatic renewal of license is opted. CAM Max Users Maximum number of users that can be enrolled CAM Max Servers Maximum number of servers that Korumail can be installed. CAM Activation Limit The number of times the same license key can be used to activate Korumail in the same machine. CAM License First Installation Date Indicates the date when the license was activated. CAM License Expiration Date Indicates the license expiry date CAM License Status Indicates the status of the license, whether it is valid or expired. To purchase a license Click the 'Click here to get CAM license key' in the 'Licenses' tab......or in the 'License Activation' tab. 38

39 You will be taken to Comodo Accounts Manager (CAM) login page at Login to your CAM account or create a new one and complete the KoruMail license purchase procedure. A license key will be sent to your address that was provided at the time of CAM sign-up. To activate your license Click the 'License Activation' tab. Copy and paste the license key that was sent to your address from Comodo in the 'CAM Activation Key' field. Click the 'Save' button. The license key will be checked and if validated, the 'Licenses' interface will be updated accordingly. End User License Agreement (EULA) Click the 'End User License Agreement' tab. 39

40 Read the EULA fully. You can also download the EULA from the screen by clicking the 'Download As PDF' link at the bottom. 7.4 Click 'OK' to download the file to your system. Configuring System Settings The 'Settings' interface in KoruMail web console allow administrators to configure various parameters such as cache settings for Greylist IP, LDAP, SMTP-Auth logs, user session timout duration, system backup and restore, log upload settings and more. To open the interface, click the 'System' tab and then the 'Settings' sub tab. 40

41 Click the following links for more details: General Cache Session GUI Customization Backup Restore Log Upload Postmaster SMTP TLS Database Update Syslog System General Settings The 'General' settings tab allows administrators to enable/disable the option to upload spam messages detected by KoruMail to Comodo labs for analytical purposes. To open the 'General' settings interface, click the 'System' tab on the left side, then 'Settings' and 'General' tab Permit Processing User Data: If enabled, spam messages detected by KoruMail will be uploaded to Comodo labs for analysis. Click the 'Save' button to apply your changes Cache Settings The 'Cache' settings tab allow administrators to set the cache expire time for Greylist IP addresses, SMTP Auth logs and LDAP. To open the 'Cache' settings interface, click the 'System' tab on the left side, then 'Settings' and 'Cache' tab 41

42 Greylist IP Cache expire time: KoruMail greylists IP addresses from which s are received for the first time and rejects it. If the sender is using a proper mail server, it automatically resends the . The greylisted IP becomes whitelisted and is not rejected. If the mail is from a spam source, then normally it will not resend mails. Enter the time for which the greylisted IPs should be cached. If within this time s are resent from greylisted IPs, they are whitelisted. After the entered time, the greylisted IPs are deleted from the greylist. SMTP AUTH logs expire time: The end user authentication log details of SMTP clients are cached for the entered days and after that they are deleted. LDAP Cache: LDAP authentication details are cached and KoruMail does not query the LDAP server. Click the 'Clear Now' beside an item to clear the cache immediately. Click the 'Save' button to apply your changes Session Settings The 'Session' settings tab allow administrators to configure the session inactivity period as well as to limit the number of times an administrator can log into the web console after which the login password has to be changed. To open the 'Session' settings interface, click the 'System' tab on the left side, then 'Settings' and 'Session' tab Session Timeout Duration: Enter the period of session inactivity after which the administrator has to login again. Login Limit: Enter the number of users that can login to the portal at the same time. Click the 'Save' button to apply your changes GUI Customization The 'GUI Customization' tab lets you customize the look and feel of KoruMail web console according to your preferences. You can also change the name and the logo to be displayed in the interface. To open the 'GUI Customization' settings interface, click the 'System' tab on the left side, then 'Settings' and 'GUI Customization' tab 42

43 Company: Enter the name of the company to be displayed Logo: To upload the logo to be displayed, click the 'Upload' button, navigate to the location where it is saved and click 'Open'. The image will be uploaded and displayed in the interface. Please note the image should be in.png format and its size should not be greater than 150 width x 100 length. To remove the logo, click the 'Clear' link. Click the 'Save' button to upload the logo. Theme: The 'Themes' drop-down allows you to choose the colors and appearance of the GUI as you prefer (Default = Redmond Theme). Click the 'Save' button to apply your changes System Backup The 'Backup' tab allow administrators to backup all configurations and logs. You can also automate the backup process by scheduling the backup dates and time. You can restore the stored back up in case the need arises. To open the 'Backup' settings interface, click the 'System' tab on the left side, then 'Settings' and 'Backup' tab 43

44 Instant Backup To take an instant backup, enter the password, confirm it and click the 'Create Backup' button. The system will backup the files and the backup download link will be displayed. Click the 'Click here to download backup' link. 44

45 Click 'OK' to save the file in your system. The 'Backup' file can be restored later from the 'Restore' tab. Scheduled Backup You can automate the backup process by scheduling the jobs. To schedule a backup job, select the 'Enable Auto Backup' check box. Host: The name or IP of the system where the data should be backed up. User: The user name of the system Password: Enter the password to access the system Remote Path: Enter the remote path of the system including the folder name. Leaving the field blank means the backup will be uploaded to the default FTP folder. Backup type: Select the backup type from the drop-down. Currently only FTP option is available. Days to backup: Schedule the backup day(s) from the options. Backup hour: Select the hour when the scheduled backup should run on the selected backup day(s) 45

46 Click the 'Save' button. The scheduled job will be saved. To change the schedule or the backup location, edit the settings accordingly and click the 'Save' button System Restore You can restore the configurations and logs that are backed up to KoruMail again. Please note that for a restore operation to be completed, KoruMail has to be rebooted. To open the 'Restore' settings interface, click the 'System' tab on the left side, then 'Settings' and 'Restore' tab To restore, click the 'Upload' button, navigate to the location where the backup file is saved and click 'Open'. After uploading, the backup file will be displayed on the screen. To remove the file, click the 'Clear' link beside it. To restore the backup, enter the backup password and click the 'Restore' button. For the restore operation to be completed, KoruMail has to be rebooted. Click 'OK' to confirm. 46

47 7.4.7 Log Upload Settings The 'Log Upload' tab allow administrators to automate the process to save the logs such as SMTP Auth, Engine, Delivery, Mail and more. To open the 'Log Upload' settings interface, click the 'System' tab on the left side, then 'Settings' and 'Log Upload' tab Host: The name or IP of the system where the logs should be uploaded. User: The user name of the system Password: Enter the password to access the system Remote Path: Enter the remote path of the system including the folder name. Leaving the field blank means the logs will be uploaded to the default FTP folder. Upload type: Select the upload type from the drop-down. Currently only FTP option is available. Days to upload: Schedule the upload day(s) from the options. Upload hour: Select the hour when the scheduled upload should run on the selected upload day(s) Click the 'Save' button. The scheduled job will be saved. To change the schedule or the upload location, edit the settings accordingly and click the 'Save' button Postmaster Settings It is a statutory requirement to set a postmaster address for all SMTP domains, where errors in process are directed. Postmaster addresses are commonly targeted by spammers to send unsolicited messages. Similarly, spammers also use the mailer-daemon route to flood users with spam messages. KoruMail allow administrators to forward these to other addresses and /or reject s sent to these addresses. To open the 'Postmaster' settings interface, click the 'System' tab on the left side, then 'Settings' and 'Postmaster' tab Postmaster Forwarding Address: Enter the forwarding address to which the to postmaster are directed. 47